dst->neighbour owns the neighbour entry for the destination.
For multicast, we know its link-layer address
(filled in ndisc_constructor()).

For unicast, the link-layer address may be unknown.
ip6_output2() will call ip6_output_finish() and
it tries inserting the link-layer header.
The destination link-layer address is used if it is known (*).
(Note: you remember that we know link-layer address for multicast.)

If the link-layer address is not known or invalid,
we queue the packet and resolve the link-layer address for the destination.
Here, since the neighbour entry is "invalid," *multicast* NS is sent.
The NS packet passes similar path.
We know the destination for the NS is multicast and
what the link-layer address is, and the packet is sent via (*).

We will send the queued packet when we got NA from that node.
Real story:

A node may send NS without source link-layer address option
while we do not know the link-layer address for the source of the NS.

We need to send NA in reply to this NS.
Original code cannot handle this case. The new code path can.

You just described how the normal link layer address resolving goes. It
doesn't apply here. Again, there is no dst->neighbour.